AWS VPC via S3 Setup (CloudFormation method)

This document provides instructions for configuring the collection of AWS VPC Flow Logs with an S3 bucket and configure log notification with SNS and SQS using AWS CloudFormation.

🚧It is recommended that the s3 bucket is in the same region as the VPC. If you pointed multiple flow logs to the same bucket they will need to be differentiated by the folder prefix.

AWS CloudFormation Steps

1. Setup supporting configuration with Cloudformation template

2. Create VPC Flow Logs that Publish to S3

Setup Cloudformation template

Setup supporting configuration with Cloudformation template

1. In the AWS Console select Services and type cloudformation into the search bar

2. Click Create stack then With new resources(standard)

3. You will see the import overview, click next

4. Make sure Amazon S3 URL is checked and input the following URL then click next https://neto-downloads.s3.amazonaws.com/aws/vpc-flow-logs/Netography-AWS-Cloud-Formation.v2.(s3).json

5. Choose a stack name and a unique S3 bucket name

6. TrafficType is ALL by default

7. Add tags for the stack (optional) and click next

8. Review and check the "I acknowledge that AWS CloudFormation might create IAM resources with custom names."

9. Now click Create stack

10. Take note of the information on the Outputs tab

Create VPC Flow Logs

Create VPC Flow Logs that publishes to S3

1. In the AWS Console select Services and type vpc into the search bar

2. Click VPC then select your VPC and click the Flow Logs tab

   
3. Then click create flow Log

   Filter	All
   Maximum aggregation interval	1 minute
   Destination	Send to S3 bucket
   S3 bucket ARN	Enter your S3 bucket ARN (from stack outputs tab in CF)
   Format	Custom format
   Access tier	Select the IAM role
   Format	Custom format
   Log format	${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status} ${tcp-flags} ${type} ${pkt-dstaddr} ${pkt-srcaddr}${instance-id} ${vpc-id} ${az-id} ${sublocation-id} ${sublocation-type} ${subnet-id}

4. Click create

Netography Portal Steps

Navigate to Traffic Sources, and click "Add Traffic Source", then select AWS S3

Configuration

The path to the S3 bucket ARN is constructed using the Account ID and Region fields, along with the current date, using the following structure: AWSLogs/{Account ID}/vpcflowlogs/{Region}/YYYY/MM/DD/

Example: AWSLogs/123456789012/vpcflowlogs/us-east-1/2023/06/28/

The Prefix field can be used if the flow logs are being organized in folders. e.g. setting the Prefix to folder_name would modify the above to become folder_name/AWSLogs/123456789012/vpcflowlogs/us-east-1/2023/06/28/

The following fields are specific to the AWS S3 configuration.

Field	Required	Description	Examples
Account ID	yes	Account ID of the flow source	1234-5678-9012
Region	yes	Location of the flow source	us-east-1
Bucket	yes	The S3 bucket name	bucket_name
Bucket Region	yes	The region of the S3 bucket	us-east-1
Remove Log		Remove the log from the S3 bucket after processing
Prefix		Folder prefix	folder_name

Authentication

Netography Fusion can access your AWS account using one of two different methods:

1. IAM user via an Access Key ID & Secret Access Key

2. IAM Roles using a Custom Trust Policy created by Netography.

AWS Access Key

To configure access via Access Key/Secret, select the "Key/Secret" Authentication Type. The values for the ID and Secret are accessible in the AWS IAM console.

AWS IAM Roles

You can use an IAM role in Netography Fusion to access your Cloud Flow Logs for flow ingest or account data for the AWS Context Integration. To enable this, go to the portal and retrieve the AWS Account ID and External ID from your Account Settings. Navigate to the gear button on the top right to view your Account Settings to see the Overview tab as shown below:

In AWS, you will configure permissions using the Account ID grabbed from above to create the IAM Role. When configured, AWS creates the Amazon Resource Number (ARN) for the role. For more information in configuring the permissions to the Account ID, refer to the external ID guide.

🚧The newly created ARN is required in order to configure IAM role access in the Netography Fusion portal.

Once the ARN has been created, the remaining steps are to toggle the Authentication Type to Role in your AWS

S3 configuration settings, input the AWS Account ID grabbed earlier from your Netography account settings, and the supply the ARN configured from AWS as shown below: